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IN THE UNITED STATES DISTRICT COURT 
FOR THE WESTERN DISTRICT OF PENNSYLVANIA 

UNITED STATES OF AMERICA 

V, 

RYAN ANDREW GUSTAFSON 
a/k/a/ Jack Farrel 
a/k/a/ Willy Clock 

AFFIDAVIT IN SUPPORT OF COMPLAINT 

I, Special Agent Keith E. Heckman, being first duly sworn, hereby depose and state as 
follows: 

INTRODUCTION AND AGENT BACKGROUND 

1. I am a Special Agent with the United States Secret Service ("USSS"). In this 
capacity, I am responsible for investigating possible violations of federal criminal law, including 
the manufacturing and distribution of counterfeit Federal Reserve Notes ("FRNs") in violation of 
18 U.S.C. §§ 371 (conspiracy), 470 (counterfeit acts committed outside the United States), 471 
(manufacturing of counterfeit obligations), 472 (uttering counterfeit obligations), 473 (dealing in 
counterfeit obligations), and 1029 (access device fraud). 

2. I have been employed as a Special Agent with the Secret Service since July 08, 
1996, and I am currently assigned to the Pittsburgh Field Office. I primarily investigate financial 
fraud and counterfeiting crimes. By virtue of my USSS employment, I have gained experience 
in conducting such investigations, in drafting and execufing search and arrest warrants relating to 
manufacturing and distribution of counterfeited U.S. currency, and in the collection of 
computer-related evidence. I also have received extensive training in general law enforcement 
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and criminal investigations, including the manufacturing and distribution of counterfeit United 
States currency, access devices, and identity theft violations at the Federal Law Enforcement 
Training Center, in Glynco, Georgia and at the James J. Rowley Training Center in Behsville, 
Maryland. 

3. By virtue of my USSS employment, I perform and have performed a variety of 
investigative tasks, including functioning as a case agent on counterfeiting cases. I have received 
extensive training in general law enforcement and criminal investigations, including the 
manufacturing and distribution of counterfeit United States currency, access devices, and identity 
theft violations at the Federal Law Enforcement Training Center, in Glynco, Georgia and at the 
James J. Rowley Training Center in Beltsville, Maryland. Moreover, I have gained experience in 
conducting such investigations and in executing search and seizure warrants. 

4. As a federal agent, I am authorized to investigate violations of laws of the United 
States and am a law enforcement officer with the authority to execute warrants issued under the 
authority of the United States. 

5. The information contained in this affidavit is based upon my personal knowledge, 
knowledge obtained during my participation in this investigation, knowledge obtained from other 
individuals including other law enforcement personnel and witnesses, knowledge obtained from 
my review of documents, electronic records, counterfeit Federal Reserve Notes, and other 
evidence related to this investigation, and knowledge gained through my training and experience. 
All conversations and statements described in this affidavit are related in substance and in part 
unless otherwise indicated. Because this affidavit is being submitted for the limited purpose of 
establishing probable cause, I have not included every detail of every aspect of the investigation. 
Rather, I have set forth only those facts that I believe are necessary to establish probable cause. 
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6. This Affidavit is in support of an application for a criminal complaint against and 
an arrest warrant for RYAN ANDREW GUSTAFSON, also known as "Jack Farrel" and "Willy 
Clock." As set forth herein, there exists probable cause to believe that RYAN ANDREW 
GUSTAFSON and others have violated Title 18, United States Code, Sections 371 (Conspiracy) 
and 470 (Counterfeiting Acts Committed Outside the United States). 

PROBABLE CAUSE 

A, Overview 

7. This affidavit establishes probable cause to believe that GUSTAFSON and others 
are participating in a conspiracy to manufacture, deal in, possess, and pass counterfeit Federal 
Reserve Notes that are believe^ to be manufactured in Uganda. 

8. This affidavit also establishes probable cause to believe that GUSTAFSON 
manufactured counterfeit Federal Reserve Notes in Uganda and sold and exchanged counterfeit 
Federal Reserve Notes in Uganda. 

9. At all times material to this affidavit, RYAN ANDREW GUSTAFSON was a 
citizen of the United States and an adult individual who was bom in August of 1 987. He uses the 
nicknames "Willy Clock" and "Jack Farrel," and he currently lives in Kampala, Uganda. 

1 0. At all times material to this affidavit, J.G. lived in the Western District of 
Pennsylvania. 

B. Counterfeit Federal Reserve Notes in Western District of Pennsylvania 

11. Starting in December 2013, the United States Secret Service (USSS) began 
investigating the passing of counterfeit Federal Reserve Notes (FRNs) believed to be 
manufactured in Uganda at retail stores and businesses in the Western District of Pennsylvania. 
As a result of this investigation, the USSS collected the counterfeit FRNs that were passed. 
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These notes, based on analysis, matched the make and identifiers of notes known to be 
manufactured in Uganda; the USSS, therefore, beheves that these counterfeit FRNs were 
manufactured in Uganda. 

12. In addition, USSS collected surveillance videos, witness statements, and 
sale/return receipts concerning the passing of these counterfeit FRNs. 

13. On December 26, 2013, a counterfeit $100 FRNs was passed at Feet's Coffee in 
the Oakland neighborhood in Pittsburgh, Pennsylvania. Receipts show that an individual bought 
a coffee with a counterfeit $100 FRN and received $96.15 in genuine U.S. currency in change. 
Video surveillance captured an individual, later identified as J.G., passing the counterfeit $100 
FRN to effectuate this transaction. 

14. Also, on December 26, 2013, counterfeit $100 FRNs were passed in two 
transactions at Rite-Aid in the Oakland neighborhood in Pittsburgh, Pennsylvania. First, the 
individual made a small item purchase with a single counterfeit $100.00 FRN and received $80 
genuine U.S. currency. Second, this individual used sixteen (16) $100.00 counterfeit FRNs to 
wire transfer $1,500 via Western Union. Records from Western Union confirmed that this 
$1,500 wire transfer was sent to an individual in Uganda. USSS obtained video surveillance 
from Rite-Aid of these transactions, which depicts J.G. passing the counterfeit $100 FRNs. 

15. On January 25, 2014, counterfeit $50 FRNs were passed at CVS in Carnegie, 
Pennsylvania. Video surveillance showed J.G. passing nine (9) counterfeit $50.00 FRNs to 
purchase a prepaid debit/credit card. 

16. On January 29, 2014, counterfeit $20 FRNs were passed at Walgreens in 
McCandless Township, Pennsylvania. Twenty-five counterfeit $20 FRNs were used to purchase 
a PayPal card. Based on my training, knowledge, and experience, your Affiant knows that 
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PayPal cards operate similarly to credits cards. USSS obtained video surveillance of this 
transaction, which showed J.G. passing the counterfeit FRNs. 

17. Law enforcement was able to identify the individual in these surveillance videos 
as J.G. because J.G. was recently placed on pretrial supervision for an unrelated criminal case 
pending before the United States District Court in the Western District of Pennsylvania. USSS 
reviewed the surveillance videos and was able to identify the individual on the video as J.G. 

18. In each of the transactions described above, USSS recovered the counterfeit FRNs 
passed by J.G. Special Agent Timothy Spiess reviewed the recovered FRNs and was able to 
determine that they were not genuine United States currency. 

19. In addition, USSS compared the identifiers found on the suspect notes with 
known samples of counterfeit notes produced in Uganda. USSS analysis confirmed that these 
counterfeit FRNs matched the identifying features of counterfeit notes that are known to have 
originated from Uganda. 

20. As part of J.G.'s unrelated criminal case, the FBI was aware that J.G. rented the 
postal box 395 at The UPS Store at 1739 East Carson Street, Pittsburgh, PA 15203. On or about 
February 19, 2014, law enforcement learned that J.G. received three DHL packages from 
Uganda to this UPS Store Box 395. These packages were addressed from Beyond Computers, 
Titanic Plaza Wilson Road, PO Box 37644, Shop TD 1 1, Kampala, Uganda. The packages also 
contained the specific name of the individual who shipped the packages. This person will be 
referred herein as A.B. 

21. On February 21, 2014, law enforcement obtained a search and seizure warrant to 
open these three DHL packages as well as other mail items for evidence of counterfeiting 
currency. United States Secret Service Special Agent Timothy Spiess executed this search 
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warrant; contained inside these DHL packages were either a blank white paper or a document 
that purported to be a general partnership agreement. However, Special Agent Spiess found 
counterfeit FRNs that were located in two hidden compartments within a secondary package 
inside the shipping envelope. The USSS has reviewed all the bills found in these three packages 
and was able to determine that all the bills were not genuine U.S. currency. In total, USSS found 
counterfeit $100, $50, and $20 FRNs totaling approximately $7,000 inside these three DHL 
packages. The USSS matched the identifying features of the approximate $7,000 in counterfeit 
FRNs with those that are known to have originated from Uganda. 

22. The packages, the blank white papers, the general partnership agreements, and a 
few representative counterfeit bills were submitted for fingerprint analysis. This analysis 
resulted in a positive identification; the forensic laboratory was able to find a fingerprint on the 
general partnership agreement that belonged to RYAN ANDREW GUSTAFSON. 

23. Additionally, USSS requested assistance from United States Customs and Border 
Protection ("CBP") to identify recent DHL packages coming from Kampala, Uganda to the 
United States that were associated with A.B. As a result, law enforcement officials were 
successful in seizing numerous packages containing counterfeit FRNs. 

C, Shipments of Counterfeit Federal Reserve Notes from Uganda 

24. The Secret Service worked with Ugandan authorities to identify the source of 
these counterfeit Federal Reserve Notes. This investigation focused on A.B., the person who 
sent the packages to J.G. Ugandan authorities, with assistance from Secret Service, arrested and 
interviewed A.B. A.B. admitted to sending the packages containing counterfeit U.S. currency to 
the United States. He explained that an American, who used the name Jack Farrel, and another 
individual known as Lumu Jumah provided him the counterfeit Federal Reserve Notes to ship. 
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25. Your Affiant is aware that Facebook owns and operates a free-access social 
networking website of the same name that can be accessed at http://www.facebook.com. 
Facebook allows its users to establish accounts with Facebook, and users can then use their 
accounts to share photographs, videos, written news, personal information, and other information 
with other Facebook users and sometimes with the general public. 

26. Secret Service searched Facebook for the name Jack Farrel and discovered a 
Facebook user site for an individual named Jack Farrel who claimed to live in Uganda. This 
user's Facebook site also had photographs of Jack Farrel. 

27. A.B. was shown one of the photographs from Jack Farrel's Facebook site. A.B. 
confirmed that this photograph was the Jack Farrel who provided him with the counterfeit 
Federal Reserve Notes. 

28. Facial recognition analysis matched Jack Farrel's photograph with a Texas 
Department of Motor Vehicle photo of RYAN ANDREW GUSTAFSON. 

29. Ugandan authorities are prosecuting A.B. for his role in this counterfeiting 
operation. 

D. J.G/s Communications with Willy Clock 

30. Law enforcement agents interviewed J.G. concerning the counterfeit Federal 
Reserve Notes. J.G. explained that he met Willy Clock on an online criminal forum/marketplace 
called Tor Carding Forum ("TCF"). J.G. accessed the internet in Pittsburgh, Pennsylvania. 
Through private messaging on the TCF, J.G. and Willy Clock discussed counterfeit currency 
including printing methods and craft trade concerns. J.G. agreed to purchase $4,000.00 in 
counterfeit U.S. Federal Reserve Notes and Willy Clock instructed J.G. to wire the money 
through Western Union to Lumu Jumah in Uganda. On December 18, 2013, J.G. sent $1,500 in 
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genuine U.S. currency through Western Union to Lumu Jumah. Willy Clock sent the counterfeit 
Federal Reserve Notes in two separate shipments to J.G. in the Western District of Pennsylvania. 
Each shipment contained $2,000 in counterfeit $100 Federal Reserve Notes. 

3 1 . J.G. made subsequent purchases of counterfeit Federal Reserve Notes from Willy 
Clock. J.G. also communicated with Willy Clock through Willy Clock's jabber* account 
mrclock@iabber.org . 

32. Sometime in January 2014, Willy Clock informed J.G. that he set up his own 
online forum called Community-X, which was a TOR website dedicated to the selling of 
counterfeit Federal Reserve Notes. J.G, was invited to join Community-X. Community-X is an 
online forum that requires a usemame and password to access, and individuals must be invited 
and approved by Willy Clock in order to become members of the site. Members can 
communicate to each other openly on a community message board or can communicate with 
selected members through private messaging. On the Community-X forum, Willy Clock 
discusses his counterfeit notes and members talked to each other about the passing of counterfeit 
notes. 



Jabber communication is essentially a near real-time instant messaging service. Jabber 
generally requires a central server to coordinate ingoing and outgoing messages. The messages 
are sent to and from account holders whose account address appear similar to e-mail addresses; 
for examplejohndoe@jabberserver.com would be the Jabber address for the unique jabber 
account of johndoe andjabberserver.com is the Jabber server. Usually, Jabber messages are not 
retained by the sender or the receiver unless those account holders manually choose to log or 
record their conversations. 

TOR, also known as 'The Onion Router," is free software that uses a network of computers 
that allows computer users to access the Internet anonymously. TOR directs the users Internet 
traffic through this computer network such that users' IP addresses are hidden. The IP address 
used to access a website is, essentially, a random IP address of a TOR computer. In addition, 
there are certain websites that can only be accessed through the use of TOR. These websites 
contain a .onion domain name, and their location (i.e., the IP addresses hosting these websites) 
also are hidden. Community X is a TOR website that has a .onion domain name. 
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33. In addition, through Community-X, Willy Clock offered an instructional guide 
that discussed how to successfully pass counterfeit Federal Reserve Notes without getting 
detected. Willy Clock sent J,G. a copy of this guide. 

34. After being arrested by Secret Service in February 2014, J.G. was banned from 
Community-X by Willy Clock. 

E, Undercover Communications with Willy Clock 

35. USSS obtained access to a Confidential Informant's Community-X account. This 
undercover operative (referred herein as "CI-l") began communicating with Willy Clock around 
April 30, 2014. In addition to Community-X, Willy Clock provided CI-1 with a number of ways 
to contact him, including the email accounts willv.clock@yandexxom , the ICQ (instant 
messaging) account number 661656905, the jabber (instant messaging) accounts 
willy.clock@jabber.ru and mrclock@jabber.org. 

36. Through these accounts, CI-1 arranged the purchase of $5000.00 counterfeit $50 
and $100 FRNs on or about April 30, 2014 and May 1, 2014. Based on Willy Clock's 
instructions, CI-1 wired genuine U.S. currency to a fake name that Willy Clock provided. 

37. On May 20, 2014, Willy Clock sent two emails to CI-1 from his 
willy.clock@yandex.com . In the first email, Willy Clock apologized that the shipment to CI-1 
was taking so long and promised to send the tracking number of the package. In the second 
email, Willy Clock sent the tracking number. The first email was sent at 20:30:39 UTC and the 
second email was sent at 21 :42:04 UTC. Both emails were sent from the IP address 
79.143.82.250, which resolves to an Internet Service Provider in Great Britain. 

38. During this investigation, the Secret Service learned that there were a number of 
Facebook accounts under the name of Jack Farrel and Ryan Gustafson that appear to be used 
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and/or controlled RYAN ANDREW GUSTAFSON. For instance, the Jack Farrel 94 account is 
associated with the same email address that Gustafson provided on his U.S. passport application. 
In addition, on a number of occasions, this account was accessed with the same IP address on the 
same date around the same time that, another account, the El Jack Farrel account was accessed. 
Based on my knowledge, training, and experience, the use of the same IP at the same date and 
time frequently indicates that the same individual accessed both accounts. In addition, the Ryan 
Gustafson 39 account is associated with the email address iackfarrel@livexom . 

39. According to records from Facebook, an individual logged into the El Jack Farrel 
account on May 20, 2014 at 10:26:52 UTC with the IP Address 79.143,82.250, which is the 
same IP address and the same date that Willy Clock sent the two emails to the CM . Although 
the El Jack Farrel account was logged into from the IP address 50.23.1 15.125 on May 20, 2014 
at 19:10:12 UTC and 19:10:27 UTC, there was no corresponding logout from the 79.143.82.250 
IP address. Thus, it is possible that the later log ins may have been from different computers. 
Nevertheless, the same Great Britain IP address accessed the El Jack Farrel Facebook account 
and sent the email to CI-1 on the same day. 

40. On May 23, 2014, a United States Postal Service (USPS) Priority Mail parcel was 
delivered to CI-l's undercover address. The USPS tracking number for this package was the 
same number that Willy Clock provided in his May 20, 2014 email. A review of the contents of 
the shipment revealed the package contained fifty-two (52) counterfeit $100 FRNs. USSS 
analyzed these 52 bills and determined that the bills were not genuine U.S. currency. In 



^ This suggests that RYAN ANDREW GUSTAFSON has more than one electronic device that is 
capable of accessing the Internet. 
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addition, the bills matched the make and identifiers of notes known to be manufactured in 
Uganda. 

41. Based on discussions between CI-1 and Willy Clock, CI-1 learned that Willy 
Clock was using U.S. -based re-shippers to ship packages of counterfeit Federal Reserve notes 
within the United States. The May 23 package was sent through a re-shipper. A re-shipper is an 
individual, who is recruited by another to accept shipments on the sender's behalf and then 
forward onto others as a means of maintaining anonymity of the sender. This process injects 
layers into the shipping process and can be used to mask the identity of the sender, the recipient, 
or both. 

42. The CI-1 entered discussions with Willy Clock to be a re-shipper of counterfeit 
Federal Reserve notes. Willy Clock agreed to give the CI-1 an opportunity to be a re-shipper. 
Willy Clock informed CI-1 that the counterfeit currency must be treated by the re-shipper. 

43. On or about September 17, 2014, Willy Clock created a sub-thread on 
Community-X called ''AnonHands UPDATE!" that was located within the thread 
AnonymousHands. Based on the pictures and description provided by Willy Clock on the sub- 
thread, "Anon Hands" are rubber molds of Willy Clock's hands that have the appearance and 
color of a real hand. They fit like gloves over his real hands and are meant to conceal his 
fingerprints. In the thread, Willy Clock indicated that he had "Anon Hands" made for himself 

44. Although CI-1 eventually became a re-shipper, he was a low level re-shipper and 
always received packages from other U.S.-based re-shippers. CI-1 received a number of other 
Willy Clock packages. For instance, through Willy Clock, a U.S.-based re-shipper sent a United 
States Postal Service (USPS) Priority Mail parcel to CI-1 . This parcel was delivered to CI-l's 
undercover address on or about October 7, 2014. A review of the contents of the package 
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revealed the package contained $3,000.00 in counterfeit $100 Federal Reserve notes. In fact, the 
USSS analyzed the $3,000 in counterfeit FRNs and was able to determine that they were not 
genuine United States currency. In addition, the USSS matched the identifying features of these 
counterfeit notes with those that have originated from Uganda. 

45. In early November 2014, USSS executed a search warrant upon the residence of 
one of the re-shippers. This re-shipper became a Confidential Informant (''CI-2") for the USSS. 
CI-2 had been an active member of Community-X since January 2014. 

46. CI-2 explained that Willy Clock changed his distribution operation after USSS 
seized his DHL packages and after A.B. was arrested. According to CI-2, around July 2014, a 
Community-X member traveled to Uganda and brought back over $300,000 in counterfeit FRNs. 

47. Due to the volume of counterfeit notes, CI-2 was recruited to assist in unpacking 
the counterfeit FRNs and shipping it to the re-shippers. The counterfeit FRNs were within glued 
together pages of ''save the children" pamphlets. The process of unpacking required placing 
pamphlets in hot water until the glue dissolved. 

48. CI-2 explained the treatment process, which was similar to the treatment process 
that Willy Clock had instructed CI-1. The process involved using a heat press and hairspray so 
that the counterfeit notes could bypass detection pens and look more genuine. 

49. On or about November 17, 2014, Willy Clock made a posting stating that 
approximately $250,000 in counterfeit FRNs had "just arrived in the United States." 

F. Search and Arrest of RYAN ANDREW GUSTAFSON 

50. The Secret Service, working with Ugandan authorities, engaged confidential 
informants in Uganda who had knowledge of Jack Farrel and his counterfeit FRNs operation. 
On or about December 11, 2014, one of the Ugandan confidential informants C'CI-3") called 
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Jack Farrel to make a buy of counterfeit FRNs. CI-3 agreed to buy $10,000 of counterfeit FRNs 
from Jack Farrel for approximately 5.5 million Ugandan Shillings (which is approximately 
$2000 in genuine U.S. currency). 

5 1 . That same day, CI-3 met Jack Farrel 's houseboy, Kojo Christopher, and 
conducted the buy. Cl-3 received $10,000 in counterfeit FRNs, and Kojo Christopher received 
the genuine U.S. currency. Two trusted sources independently followed Kojo Christopher back 
to Jack Farrel's house. The trusted sources reported the location to the USSS, which provided 
the information to Dennis Owau, a detective inspector with the Uganda Special Investigation 
Unit. 

52. That same day, Detective Owau led a search of Jack Parrel's residence. Upon 
entering the residence, both RYAN ANDREW GUSTAFSON a/k/a Jack Farrel and Kojo 
Christopher were arrested. 

53. The Ugandan authorities recovered the following relevant items from the search: 
2 million Ugandan Shillings that can be traced to the buy with CI-3, "Give a Child Hope Today" 
Pamphlets with counterfeit FRNs in between glued together pages, at least 2 pages of uncut 
sheets of counterfeit FRNs, a pair of Anon hands (which looked identical to the images posted on 
Community-X), a $10,000 money wrapper with the signature of Willy Clock, $180,420 in 
counterfeit FRNs with identifiers and features similar to the other known counterfeit FRNs from 
Uganda, €13,600 in counterfeit Euros, 2,500 in counterfeit Indian Rupees, 1,500 in counterfeit 
Ugandan Shillings, 400 in counterfeit Congo Franc, 38 in counterfeit Ghana Cedi, peel off 
stickers of Euro security features that are found on Euros, 2 desktop computers, 2 laptop 
computers, approximately 10 USB thumb drives, approximately 3 routers, a number of cellular 
telephones, a number of printers, approximately 2 paper cutters, approximately 1 scanner, ink in 
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bottle, ink in cans, inkjet cartridges, counterfeit detection pens, approximately 200 glue sticks, 
receipt for the purchase of printer parts from Hong Kong, Western Union and Moneygram 
receipts, box of blank white plastic cards that are used to create credit cards, a photocopy of 
RYAN ANDREW GUSTAFSON's passport, RYAN ANDREW GUSTAFSON's Texas 
Identification Card, RYAN ANDREW GUSTAFSON's Colorado driver's license, an official 
Kenyan document charging RYAN ANDREW GUSTAFSON with unlawful possession of a 
firearm, and approximately 2 Taser guns. 

54. Some photos of the evidence seized are provided in Attachment B, which is 
attached hereto and incorporated herein by reference. 

55. USSS recovered the $10,000 in counterfeit FRNs that Kojo Christopher provided 
CI-3. USSS reviewed these bills and has determined that they are not genuine U.S. currency. In 
addition, these bills match the same identifiers and features of known Ugandan made counterfeit 
FRNs and the same identifiers and feature of the counterfeit FRNs passed by J.G. 

56. USSS placed this $10,000 in counterfeit FRNs in a USSS evidence envelope and 
provided it to Detective Owau to be placed in evidence with the items seized from RYAN 
ANDREW GUSTAFSON's residence. 

G. Summary of Counterfeit 

57. USSS typically learns about the passing of counterfeit FRNs overseas through 
criminal cases brought by local governments and by seized counterfeit FRNs that are sent to U.S. 
Embassies overseas. Based on known criminal cases and counterfeit FRNs sent to the U.S. 
Embassy in Kampala, USSS can confirm that approximately $1.8 million in counterfeh FRNs 
have been passed in Uganda. 

58. The total amount of counterfeit FRNs manufactured in Uganda that has been 
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seized or passed within the United States is approximately $270,000.00. However, as mentioned 
earlier, CI-2 has learned from Willy Clock that Willy Clock has moved approximately $5,500.00 
of counterfeit FRNs into the United States since July 2014. 



59. Based on the above information, your Affiant believes that probable cause exists 
that RYAN ANDREW GUSTAFSON violated Title 18, United States Code, Sections 371 
(Conspiracy) and 470 (counterfeit acts committed outside the United States) and prays that a 
warrant be issued for his arrest. 

The above information is true and correct to the best of my knowledge, information, and 



CONCLUSION 



belief 



Respectfully submitted. 



^eith E. Heckman 
Special Agent, United States Secret Service 




Subscribed and sworn to before me 
this \7^^ day of December, 2014 
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